In this slide, we discuss the concept of IPTABLES/EBTABLES and then show how they work in a simple docker environment.
In order to track the packet flow in those containers communication, we use the LOG module in IPTABLES/EBTABLE to track the information.
4. IPTABLES Series
Introduction to IPTABLES
Learn IPTABLES by Docker environment.
Implementation of IPTABLES
User Space/Kernel Space
Implement our own iptables modules
Kubernetes Service discussion
Layer4 load-balancing, why ?
Modify the kernel module to make it support Layer7, really ?
9. Chain (EBTABLES)
INPUT
Frames destined for the bridge
itself
FORWARD
Frames being forwarded by the
bridges
OUTPUT
Locally-generated
Routed frames
PREROUTING (PREFORWARDING)
Altering frames as soon as they come
in
POSTROUTING (POSTFORWARDING)
Altering frames as they are about to
go out
BROUTING
Traversed very early, route or bridge
frame.
12. Observe Flows
We use the target LOG to log the packet information and then learn the
packer flow in different situation.
ebtables -t broute -I BROUTING --log --log-prefix 'ctc/ebtable/
broute-BROUTING' --log-level debug
We focus on
Host to container
Container to container
25. Tables (IBTABLES)
Raw
For non-tracking packets. (Before conntrack)
Mangle
Change packet's information
Filter
Filter packets
NAT
Change IP address (SNAT/DNAT)
26. Chain (IPTABLES)
INPUT
Packets destined to local
sockets
FORWARD
Packets being routed
OUTPUT
Locally-generated packets
PREROUTING
Altering packets as soon as
they come in
POSTROUTING
Altering packets as they
are about to go out
29. Observe Flows
We use the target LOG to log the packet information and then learn the packer flow in
different situation.
iptables -t mangle -I PREROUTING -p tcp -d 172.18.0.0/16 -j LOG --log-prefix '/
iptable/mangle-PREROUTE' --log-level debug
We focus on
Container to container
Host to container
WAN to container
34. Have You Seen This?
sudo sysctl net.bridge.bridge-nf-call-iptables=1
echo '1' > /proc/sys/net/bridge/bridge-nf-call-iptables
Try to repeat this case with value '0'
45. How To Debug
No Simple Way
Strong knowledge of TCP/IP
Capture Packets by TCPDUMP
Check IPTables rules
Use the log module to capture packets (watch out match rules).
Check other build-in services.
ARPTables
Routing Tables
TC (Traffic Shaping)
Modify the Linux Kernel to print out packet information.